Keycloak’s SCIM user listing API fails to enforce per‑user VIEW authorization, allowing a service account or user with limited query permissions to retrieve full personally identifiable information, such as names and email addresses, for every non‑admin user within a realm. This oversight enables the exposure of sensitive data that should remain protected, representing a data disclosure flaw identified as CWE‑862.

The vulnerability applies to the open‑source Keycloak identity and access management platform via its SCIM user listing endpoint. No specific product version is mentioned, so all installations where the SCIM API is enabled and exposed are potentially impacted.

The CVSS score of 4.4 places this issue in the moderate range, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at this time. Exploitation requires authenticated access to the SCIM API, typically by a service account or user with constrained query rights. An attacker who obtains such credentials could retrieve the entire list of user PII, leading to unauthorization data exposure but no direct privilege escalation or code execution.